Measurement device independent quantum key distribution 
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How to remove detector side channel attacks has been a notoriously hard problem in quantum 
cryptography. Here, we propose a simple solution to this problem — measurement device independent 
quantum key distribution. It not only removes all detector side channels, but also doubles the 
secure distance with conventional lasers. Our proposal can be implemented with standard optical 
components with low detection efficiency and highly lossy channels. In contrast to the previous 
solution of full device independent QKD, the realization of our idea does not require detectors of 
near unity detection efficiency in combination with a qubit amplifier (based on teleportation) or a 
quantum non-demolition measurement of the number of photons in a pulse. Furthermore, its key 
generation rate is many orders of magnitude higher than that based on full device independent QKD. 
The results show that long-distance quantum cryptography over say 200km will remain secure even 
with seriously flawed detectors. 



Quantum key distribution (QKD) allows two parties 
(typically called Alice and Bob) to generate a common 
string of secret bits, called a secret key, in the presence 
of an eavesdropper, Eve [1!]. This key can be used for 
tasks such as secure communication and authentication. 
Unfortunately, there is a big gap between the theory and 
practice of QKD. In principle, QKD offers unconditional 
security guaranteed by the laws of physics 041] • How- 
ever, real-life implementations of QKD rarely conform 
to the assumptions in idealized models used in security 
proofs. Indeed, by exploiting security loopholes in practi- 
cal realizations, especially imperfections in the detectors, 
different attacks have been successfully launched against 
commercial QKD systems 0, 0] , thus highlighting their 
practical vulnerabilities. 

To connect theory with practice again, several ap- 
proaches have been proposed. The first one is the pre- 
sumably hard- verifiable problem of trying to characterize 
real devices fully and account for all side channels. The 
second approach is a teleportation trick @, 0] • The third 
solution is (full) device independent QKD (DI-QKD) @. 
This last technique does not require detailed knowledge 
of how QKD devices work and can prove security based 
on the violation of a Bell inequality. Unfortunately, DI- 
QKD is highly impractical because it needs near unity 
detection efficiency together with a qubit amplifier or 
a quantum non-demolition (QND) measurement of the 
number of photons in a pulse, and even then generates 
an extremely low key rate (of order 10 -10 bits per pulse) 
at practical distances [Toj . 

In this Letter we present the idea of measurement de- 
vice independent QKD (MDI-QKD) as a simple solution 
to remove all (existing and yet to be discovered) detector 
side channels @, arguably the most critical part of the 
implementation, and show that it has both excellent se- 
curity and performance. Therefore, it offers an immense 
security advantage over standard security proofs such as 



Inamori-Lutkenhaus-Mayers (ILM) [Tlj and Gottesman- 
Lo-Lutkenhaus-Preskill (GLLP) [12 ]. Furthermore, it 
has the power to double the transmission distance that 
can be covered by those QKD schemes that use conven- 
tional laser diodes, and its key generation rate is compa- 
rable to that of standard security proofs with entangled 
pairs. In contrast to DI-QKD, in its simplest formulation 
MDI-QKD requires the additional assumption that Alice 
and Bob have almost perfect state preparation. How- 
ever, we believe that this is only a minor drawback be- 
cause Alice's and Bob's signal sources can be attenuated 
laser pulses prepared by themselves. Their states can 
thus be experimentally verified in a fully protected lab- 
oratory environment outside Eve's interference through 
random sampling. Moreover, as will be discussed later, 
imperfections in Alice's and Bob's preparation process 
can, in fact, be readily taken care of in a more refined 
formulation of the protocol. 

A simple example of our method is as follows. Both 
Alice and Bob prepare phase randomized weak coherent 
pulses (WCPs) in the four possible BB84 polarization 
states [l3| and send them to an untrusted relay Charlie 
(or Eve) located in the middle, who performs a Bell state 
measurement that projects the incoming signals into a 
Bell state [l4j]. Such measurement can be realized, for 
instance, using only linear optical elements with say the 
setup given in Fig. 1. (Actually, such setup only identifies 
two of the four Bell states. But, this is fine as any Bell 
state will allow a security proof to go through.) Further- 
more, Alice and Bob apply decoy state techniques [l5[ 
to estimate the gain (i.e., the probability that the relay 
outputs a successful result) and quantum bit error rate 
(QBER) for various input photon numbers. 

Once the quantum communication phase is completed, 
Charles uses a public channel to announce the events 
where he has obtained a successful outcome in the re- 
lay, including as well his measurement result. Alice and 
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FIG. 1. Basic setup of a MDI-QKD protocol. Alice and Bob 
prepare phase randomized weak coherent pulses (WCPs) in a 
different BB84 polarization state which is selected, indepen- 
dently and at random for each signal, by means of a polar- 
ization modulator (Pol-M). Decoy states are generated using 
an intensity modulator (Decoy-IM). Inside the measurement 
device, signals from Alice and Bob interfere at a 50:50 beam 
splitter (BS) that has on each end a polarizing beam split- 
ter (PBS) projecting the input photons into either horizontal 
(H) or vertical (V) polarization states. Four single-photon 
detectors are employed to detect the photons and the detec- 
tion results are publicly announced. A successful Bell state 
measurement corresponds to the observation of precisely two 
detectors (associated to orthogonal polarizations) being trig- 
gered. A click in Dm and D2V, or in D\v and D2H, indicates 
a projection into the Bell state \ip~) = l/y/2{\HV) - \VH)), 
while a click in D\h and Div, or in D2H and D2V, reveals a 
projection into the Bell state = 1/V2(\HV) + \VH)). Al- 
ice's and Bob's laboratories are well shielded from the eaves- 
dropper, while the measurement device can be untrusted. 



Bob keep the data that correspond to these instances and 
discard the rest. Moreover, as in BB84, they post-select 
the events where they use the same basis in their trans- 
mission by means of an authenticated public channel. 
Finally, to guarantee that their bit strings are correctly 
correlated, either Alice or Bob has to apply a bit flip to 
her/his data, except for the cases where both of them 
select the diagonal basis and Charles obtains a successful 
measurement outcome corresponding to a triplet state. 
This is illustrated in Table 1. 

Alice & Bob Relay output Relay output 



Rectilinear basis Bit flip 

Diagonal basis Bit flip 



Bit flip 



TABLE I. Alice and Bob post-select the events where the 
relay outputs a successful result and they use the same basis 
in their transmission. Moreover, either Alice or Bob flips 
her/his bits except for the cases where both of them select 
the diagonal basis and the relay outputs a triplet. 

Let us now evaluate the performance of the protocol 
above in detail. The proof of its unconditional security 
is shown in Appendix |A] For simplicity, we consider a 
refined data analysis where Alice and Bob evaluate the 
data sent in two bases separately jlfjj. In particular, we 



use the rectilinear basis as the key generation basis, while 
the diagonal basis is used for testing only. A piece of 
notation: Let us denote by Q roct , Q d ; ag , e re ' ct and e diag , 
the gain and QBER, respectively, of the signal states sent 
by Alice and Bob, where n and m denote the number 
of photons sent by the legitimate users, and rect/diag 
represents their basis choice. 

(A) Rectilinear basis: An error corresponds to a suc- 
cessful relay output when both Alice and Bob prepare 
the same polarization state (i.e., their results should be 
anti-correlated before they apply a bit flip). Assuming 
for the moment ideal optical elements and detectors, and 
no misalignment, we have that whenever Alice and Bob 
send, respectively, n and m photons prepared in the same 
polarization state the relay will never output a successful 
result. We obtain then that e™J™ is zero for all n, m. This 
means that no error correction is needed for the sifted 
key. This is remarkable because it implies that the us- 
age of WCP sources (rather than single-photon sources) 
does not substantially lower the key generation rate of 
the QKD protocol (in the error correction part). 

(B) Diagonal basis: To work out the amount of privacy 
amplification needed we examine the diagonal basis. An 
error corresponds to a projection into the singlet state 
given that Alice and Bob prepared the same polarization 
state, or into the triplet state when they prepare orthogo- 
nal polarizations. Assuming again the ideal scenario dis- 
cussed in the previous paragraph, we find that e d | ag = 0. 
(This is because when two identical single-photons enter 
a 50:50 BS the Hong-Ou-Mandel (HOM) effect [13] en- 
sures that both photons will always exit the BS together 
in the same output mode. Also, if the two photons are 
prepared in orthogonal polarizations and they exit the 
50:50 BS in the same output arm, both photons will al- 
ways reach the same detector within the relay.) The fact 
that e d J ag is zero is again remarkable as it means that the 
usage of WCP sources does not substantially lower the 
key generation (in also the privacy amplification part). 

(C) Key generation rate: In the ideal scenario de- 
scribed above the key generation rate will be simply given 
by R = Qject m the asymptotic limit of an infinitely long 
key. On the other hand, if we take imperfections such 
as basis misalignment and dark counts into account, the 
key generation rate in a realistic setup will be given by 

El 13 III 

R = Q^JI - H(e^ e )} - Q r0 ct/(£rcct)ff(£rcct), (1) 



where Q roc t and -Erect denote, respectively, the gain and 
QBER in the rectilinear basis (i.e., Q rC ct = J2 n . m Q?e 

te r : nt /Qrect), /(-Erect) > 1 is an 



rcct ' 



and -Erect — 2 n ,m ^rcct '-rcct / 

inefficiency function for the error correction process, and 
H{x) = — xlog 2 (x) — (1 — x) log 2 (1 — x) is the binary 
Shannon entropy function. 

There are few loose ends that need to be tightened 
up. First, we have implicitly assumed that the decoy 
state method can be used to estimate the gain Qrect an d 
the QBER e d ' iag . 



Second, we need to evaluate the se- 
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FIG. 2. Lower bound on the secret key rate R given by 
Eq. ([T]) in logarithmic scale for the MDI-QKD setup with 
WCPs illustrated in Fig. 1 (green curve). For simulation pur- 
poses, we consider the following experimental parameters [19| : 
the loss coefficient of the channel is 0.2 dB/km, the intrinsic 
error rate due to misalignment and instability of the optical 
system is 1.5%, the detection efficiency of the relay (i.e., the 
transmittance of its optical components together with the ef- 
ficiency of its detectors) is 14.5%, and the background count 
rate is 6.02 x 10~ 6 . (For simplicity, we consider a simplified 
model of misalignment by putting a unitary rotation in one 
of the input arms of the 50:50 BS and also a unitary rotation 
in one of its output arms. The total misalignment value is 
1.5%. That is, we assume a misalignment of 0.75% in each 
rotation.) In comparison, the red curve represents a lower 
bound on R for an entanglement-based QKD protocol with 
a parametric down conversion (PDC) source situated in the 
middle between Alice and Bob [2j|. In the red curve, we 
have assumed that an optimal brightness of a PDC source 
is employed. However, in practice, the brightness of a PDC 
source is limited by technology. Therefore, the key rate of an 
entanglement-based QKD protocol will be much lower than 
what is shown in the red curve. This makes our new proposal 
even more favorable than the comparison that is presented in 
the current Figure. 



cret key rate given by Eq. ([T]) for a realistic setup. Let 
us tighten up these loose ends here. Indeed, it can be 
shown that the technique to estimate the relevant param- 
eters in the key rate formula is equivalent to that used in 
standard decoy-state QKD systems (see Appendix IBl for 
details). For simulation purposes, we consider inefficient 
and noisy threshold detectors and employ experimental 
parameters from [l9| with the exception that [l9| con- 
sidered a free-space channel whereas here we consider a 
fiber-based channel with a loss of 0.2 dB/km. Moreover, 
for simplicity, we assume that all detectors are equal (i.e., 
they have the same dark count rate and detection effi- 
ciency), and their dark counts are, to a good approxima- 
tion, independent of the incoming signals. Furthermore, 
we use an error correction protocol with inefficiency func- 
tion /(-E r cct) =1.16 [2(|. The resulting lower bound on 
the secret key rate is illustrated in Fig. 2. Our calcula- 
tions and simulation results demonstrate that the key 



FIG. 3. Hong-Ou-Mandel interference between two phase 
randomized WCPs. The average photon number is 0.1 per 
pulse. The coincidence rate is recorded at different time de- 
lays. The error bars show the statistical fluctuation (± one 
standard deviation) due to finite data size. 

rate is highly comparable to a security proof [2l| for 
entanglement-based QKD protocols. Our scheme can tol- 
erate a high optical loss of more than 40dB (i.e., 200km 
of optical fibers) when a relay is placed in the middle of 
Alice and Bob. That is, one can essentially double the 
transmission distance over a setup where the Bell mea- 
surement apparatus is on Alice's side or a setup using a 
standard decoy-state BB84 protocol 22] . 

To experimentally implement the MDI-QKD protocol 
proposed, there are a few practical issues that have to 
be addressed. Among them, the most important one is 
probably how to generate indistinguishable photons from 
two independent laser sources and observe stable HOM 
interference [13] • Note that the physics behind this pro- 
tocol is based on the photon bunching effect of two in- 
distinguishable photons at a 50:50 BS. We performed 
a simple proof of principle experiment to show that a 
high-visibility HOM interference between two indepen- 
dent off-the-shelf lasers is actually feasible (see details 
in Appendix \C\ . The results are shown in Fig. 3. The 
consistency between experimental and theoretical results 
confirms that a high-visibility HOM dip can be obtained 
even with two independent lasers. 

The idea of MDI-QKD can be generalized much fur- 
ther. First of all, it also applies to the case where Alice 
and Bob use entangled photon pairs as sources. Sec- 
ond, it works even when Alice and Bob's preparation pro- 
cesses are imperfect. Indeed, basis- dependence that orig- 
inates from the imperfection in Alice and Bob's prepa- 
ration processes can be readily taken care of by using 
a quantum coin idea 113. [l8[ to quantify the amount of 
basis-dependent flaw [24J. Third, notice that in prac- 
tical applications only a finite number of decoy states 
will be needed. This is similar to standard finite de- 
coy state QKD protocols |25l that have been widely em- 
ployed in experiments [261 ]. Fourth, MDI-QKD works 
even without a refined data analysis. Fifth, it works also 
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for other QKD protocols including the six-state protocol 
(27j . These subjects will be discussed further in future 
publications. 

In summary, we have proposed the idea of measure- 
ment device independent QKD (MDI-QKD). Compared 
to standard security proofs, it has a key advantage of re- 
moving all detector side channels, and it can double the 
transmission distance covered with conventional QKD 
schemes using WCPs. Moreover, it has a rather high key 
generation rate which is comparable to that of standard 
security proofs. Indeed, its key generation rate is orders 
of magnitude higher than the previous approach of full 
device independent QKD. Our idea can be implemented 
with standard threshold detectors with low detection ef- 
ficiency and highly lossy channels. In view of its excellent 
security, performance and simple implementation, we be- 
lieve MDI-QKD is a big step forward in bridging the gap 
between the theory and practice of QKD, and we expect 
to be widely employed in practical QKD systems in the 
future. 

Notes Added: After the posting of our paper on public 
preprint servers, another paper by Braunstein and Piran- 
dola [28[ has been posted on the preprint servers [29]. 

Useful conversations with C. H. Bennett, H. F. Chau, 
C.-H. F. Fung, P. Kwiat, X. Ma, K. Tamaki and Y. Zhao 
are gratefully acknowledged. We thank N. Liitkenhaus 
for discussions about Inamori's security proof, C. Weed- 
brook for comments on the presentation of the paper, 
and Z. Liao and Z. Tang for helping us in some parts of 
the experiment. We thank NSERC, the Canada Research 
Chair Program, Quantum Works, CIFAR and Xunta de 
Galicia for financial support. 



Appendix A: Security analysis 

Here, we show that our protocol for measurement de- 
vice independent quantum key distribution (MDI-QKD) 
is unconditionally secure. Our security proof is inspired 
by that of a time reversed EPR-based QKD protocol 
[3l| and the decoy state method [15j . It can be ap- 
plied to practical phase randomized weak coherent pulses 
(WCPs) generated by a laser pj^ . 

In the protocol, each of Alice and Bob uses decoy states 
and WCPs to prepare the four BB84 states and sends 
their state to Charles. Charles combines the two sig- 
nals sent by Alice and Bob and performs a Bell mea- 
surement. Afterwards, he announces in a public channel 
whether he has received a Bell state and which specific 
Bell state he has received, say, for instance, a singlet 
state \/y/2{\HV) - \VH)). Alice and Bob post-select 
only those transmission events where Charles has re- 
ceived some specific Bell state. 

Using decoy states, Alice and Bob can now obtain the 
gain and QBER of those events where both of them send 
to Charlie single-photon states. As in GLLP [l2j], let 
us consider a virtual qubit idea. Instead of preparing a 
single-photon BB84 state, Alice prepares its purification. 



That is to say that one could imagine that Alice actu- 
ally has a virtual qubit on her side and she prepares her 
state by first preparing an entangled state of the com- 
bined system of her virtual qubit and the qubit that she 
is sending out in say a singlet state. She subsequently 
measures her virtual qubit, thus preparing a BB84 state. 
(Similarly, Bob uses a virtual qubit to help him prepare 
a single-photon BB84 state.) 

Now, in principle, Alice could as well keep her virtual 
qubit in her quantum memory and delay her measure- 
ment on it. Only after Charles has announced that he 
has obtained a successful outcome (say a singlet), will Al- 
ice perform a measurement on her virtual qubit to decide 
on which state she is sending to Bob. 

In such virtual qubits setting, the protocol is directly 
equivalent to an entanglement based protocol @, 0, l33l j . 
Alice and Bob share a pair of qubits in their quantum 
memories and they simply compute the QBER on their 
virtual qubits in the XX and ZZ bases. 

Furthermore, with the above virtual qubit picture in 
mind, one sees that what Alice and Bob actually send 
out is unimportant for security proofs as long as their 
single-photon signals are basis-independent. In the event 
that there are some basis-dependent flaws in their prepa- 
ration, Alice and Bob can take care of them by using a 
quantum coin idea [Hill]. (Notice that GLLP pj| only 
considers imperfect state preparation by Alice. Here we 
are interested in simultaneous imperfections in both Al- 
ice and Bob. Nonetheless, with the above virtual qubit 
formulation, such simultaneous imperfections can still be 
taken care of by the quantum coin idea. One only needs 
to consider the fidelity between the combined states sent 
out by Alice and Bob p\ B and p\ B , where Alice and Bob 
both use either the X or Z basis. For a more detailed 
discussion, see, for example, [34j.) 

Furthermore, our protocol can tolerate very high chan- 
nel loss and very low success probability of a Bell mea- 
surement without compromising its security. This is be- 
cause Alice and Bob can post-select only those successful 
events for a Bell-state measurement by Charles for con- 
sideration. Note that Alice and Bob could have imple- 
mented their protocol with virtual qubits in their quan- 
tum memories and could have waited until Charles an- 
nounces which Bell-state measurement results are suc- 
cessful. Indeed, in security proofs such as @ and 
losses do not affect security. 



Appendix B: Estimation procedure 

Here we show that the decoy state method [l5[ applied 
to MDI-QKD allows Alice and Bob to estimate the rele- 
vant parameters to evaluate the secret key rate formula 
in the asymptotic regime. In particular, they can obtain 
the gain Qrect an d the QBER e d - ag . 

Our starting point is the standard decoy state tech- 
nique applied to conventional QKD. We assume it per- 
mits Alice and Bob to estimate the yield Y n and error 
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rate e ra of an n-photon signal for all n [la]. That is, the 
set of linear equations 



71=0 



Z — J 77 I 



(Bl) 



(B2) 



with the index i denoting the different decoy settings, can 
be solved and Alice and Bob can obtain the parameters 
Y n and e ra for all n. 

In MDI-QKD we have the following set of linear equa- 
tions: 
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Again, for j fixed, varying i we have that Eq. (IB7|) is 
equivalent to Eq. (JBTJ , so Alice and Bob can estimate the 
parameters W^. rect . Once these quantities are obtained 
for all j, we have that Eq. (|B8|) is equivalent to Eq. (|B2[) 
with the yields ^ r ™ c ™ already known. This means that 
Alice and Bob can estimate e™ e '" t \ 

Similarly, it can be shown that Alice and Bob can es- 

■ • , n,m 

timate e diag . 

We have demonstrated that Alice and Bob can esti- 

n,m n,m j n,vn r n 

\cct , and e diag for all 



mate the parameters Y le ' ct , Y di ' ag , < 



n and m in the asymptotic case; in particular, they can 

diag' 



obtain the relevant quantities Y T ^ ct and e H j HP .. Now, the 



gain Q rcct is given by 



- 1 recti 



(B9) 



where \ia and /its denote, respectively, the mean photon 
number of Alice and Bob's signals. 

In practical applications only a finite number of decoy 
states will be needed. This is similar to standard finite 
decoy state QKD protocols [2a, |35| . 



n ,.m 

rfj i?iJ . \ " r -Mi^ r -M, p J Y n ' m r n ' m 
^rect^rect / , c j c j ^ rcct ^roct 



n.m— 



^diag-^diag — / , 



, Mi 



I diag diag' 



where the indexes i and j represent, respectively, the 
different decoy settings used by Alice and Bob. 

Let us begin with the gain Q^cf This quantity can be 
written as 



* reel 



. .it, 

/ , ^ i n;rcct' 



n=0 



where 
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For j fixed, varying i we have that Eq. (IB5|) is equivalent 
to Eq. ()Bip . This means that Alice and Bob can esti- 
mate the parameters Y^. rcct . Once the yields Y^. roct are 
obtained for all j, we have that Eq. (|B6I) is again equiv- 
alent to Eq. (|B1[) and the legitimate users can estimate 
the parameters ^oct™- 

Similarly, it can be shown that Alice and Bob can es- 
timate r" ag . 

Let us now focus on the QBER E^ ct . It can be written 



as 



where 



Vrcct-^rcct — / y L | "rc;r 



(B7) 



Wnjrect — e Mj _!| ^rect e rect • (B8) 



Appendix C: Experimental setup of proof of concept 
experiment 

For our idea of MDI-QKD to work in practice, it is 
important to be able to obtain interference between sig- 
nals generated by two independent lasers (on Alice's and 
Bob's sides) (36[- Notice that this requirement is at the 
heart of many quantum information applications such as 
quantum repeaters, teleportation, qubit amplifiers for de- 
vice independent QKD, etc. Many investigations and a 
lot of progress have been made on this subject in recent 
years (see, e.g., [13] and references therein). 

To show that photons from two independent laser 
sources can be made indistinguishable and interfere with 
each other, we have performed a simple proof of concept 
experiment. The experimental setup is shown in Fig. 1. 

51 denotes a 1550nm cw fiber laser (NP photonics) and 

52 is a wavelength tunable cw laser (Agilent). Both lasers 
have linewidths less than 1MHz and there is no optical 
or electrical connection between them. The central wave- 
length of S2 can be adjusted at steps of 0.1pm (which 
corresponds to 13MHz at 1550nm). Two optical inten- 
sity modulators (IM1 and IM2) are employed to generate 
narrow laser pulses from the above two cw lasers. Each 
of these two intensity modulators is driven by an elec- 
trical pulse generator (Avtech, PG1 and PG2), which is 
triggered by a 4-channel delay generator (DG). The time 
delay between the two laser pulse trains can be adjusted 
by the delay generator at ps resolution. Two variable 
optical attenuators (Attl and Att2) are used to deter- 
mine the average photon number per laser pulse. An 
optical phase modulator (PM) is used to scan the phase 
of one laser pulse train. The two laser pulse trains in- 
terfere at a symmetric 2x2 fiber coupler (BS), and the 
interference signals are detected by two InGaAs single- 
photon detectors (SPD, ID Quantique). A time interval 
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FIG. 4. Experimental setup. SI: 1550nm cw fiber laser 
(NP photonics); S2: wavelength tunable cw laser (Agilent); 
IM1-IM2: optical intensity modulators; Attl-Att2: variable 
optical attenuators; PC1-PC2: polarization controllers; PM: 
optical phase modulator; BS: 50:50 fiber beam splitter; SPD1- 
SPD2: single-photon detectors; TIA: Time Interval Analyzer 
(Picoquant); PG1-PG2: electrical pulse generators (Avtech); 
AWG1-AWG2: arbitrary waveform generators (Agilent); DG: 
delay generator (Stanford research systems). 



analyzer (TIA, Picoquant) is employed to perform a co- 
incident measurement. The whole system is built upon 
single-mode telecom fiber based components, thus the 
spatial modes of the two laser beams are identical. By 
using two polarization controllers (PCI and PC2), we 
can ensure that the two laser pulse trains are in the same 
polarization state when they interfere at the BS. In this 
experiment, Alice and Bob are on the same optical table 
and the fiber length from Alice/Bob to the measurement 
device is only a few meters. 

The pulse shapes of the laser pulses that output 
from the two intensity modulators have been carefully 
matched by adjusting the two electrical pulse generators. 
This shape is approximately Gaussian with a pulse width 
(FWHM) around 200ps. The corresponding spectral 
bandwidth is about 5GHz, which is significantly larger 
than the central frequency mismatch (below 30MHz dur- 
ing the whole experiment). Thus the photons from the 



two lasers are indistinguishable in the spectral domain. 

The MDI-QKD protocol proposed encodes quantum 
information in phase randomized WCPs. This means 
that the phase should be randomly changed from pulse 
to pulse. This can be achieved by using an optical phase 
modulator after each laser to introduce a random phase 
shift from pulse to pulse, as we have demonstrated previ- 
ously 38]. Here, for simplicity, the phase shift is scanned 
periodically in the range of [0, 2ir] at 900Hz. In our ex- 
periment, the laser pulse repetition rate is 500KHz and 
one measurement takes about 500s, thus the phase is 
equivalently randomized. 

We measure the Hong-Ou-Mandel (HOM) interference 
at an average photon number of 0.1 per pulse. During 
the experiment, at each time delay St 2 —St 1 , we record the 
detection probability of SPDl (Pi), the detection prob- 
ability of SPD2 (P%), and the probability of having a 
simultaneous "click" in both SPDs within a coincidence 
window of 2ns (Pc)- The normalized coincidence rate 
is calculated as C — Pc/iPiPa)- The experimental re- 
sults are shown in Fig. 3 of the Main Text of our paper. 
For comparison purposes, this figure also includes the 
theoretical results obtained using perfect 200ps Gaussian 
pulses. The error bars arise from statistical fluctuations 
(± one standard deviation) due to finite data size. The 
measured HOM dip is 0.534± 0.005. This result confirms 
that a high-visibility HOM dip can be obtained with in- 
dependent lasers, thus demonstrating the feasibility of 
our QKD protocol. 

The major error sources in the experiment seem to be 
the pulse shape mismatch and time jitter. Limited by 
the equipment available in our lab, PG1 and PG2 are 
actually two different pulse generators which has limited 
control over pulse shapes. Other sources of errors are 
the finite extinction ratio of the intensity modulator, the 
frequency mismatch between the two lasers, the polar- 
ization mismatch, the asymmetry of the BS, the error in 
determining the average photon number, the dark counts 
of the SPDs, and statistical fluctuations due to finite data 
size. 
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